Threat watch / Attack
Check Point gateways: PHP2Shell used to break in, root, then a wiper at some Israeli organizations
Check Point Research says attackers broke into Check Point Mobile Access portals through PHP2Shell, two critical PHP flaws, starting on October 30, 2026, about a week after a fix was available. They then used a Check Point flaw (CVE-2026-123039) to become root on the gateways. Check Point says it saw that flaw actively exploited against "a couple of dozen customers". A first wave hit Israeli organizations, with destructive activity against some of them: a wiper staged on a VMware ESXi host. A second wave from November 2 hit organizations in several countries, with no destruction seen. Check Point cannot say with confidence who is behind it.
- Sector
- Many sectors
- Way in
- Software flaw
- Product or vendor
- Check Point Security Gateway, Check Point Mobile Access, PHP, VMware ESXi
- Check Point customers where the root flaw was seen actively exploited ("a couple of dozen")[2]
- ~24
- How it happened
- According to Check Point Research, initial access came through PHP2Shell (CVE-2026-109618 and CVE-2026-109619), two critical remote code execution flaws in PHP that SecurityWeek says were patched on October 21, exploited on Mobile Access portals. The attackers then used CVE-2026-123039, a local privilege escalation in Check Point's DynamicCLI process through a world-writable control socket, which lets "any authenticated local user" run commands as root. They left webshells in the portal templates and the TSGA backdoor with its TSProxy component. In the destructive cases, a Linux wiper called destroy_v6 was staged on a VMware ESXi host over SSH using the vpxuser account.[1][2][3] Checked 13 Nov 2026
- What was stolen
- Not public yet Checked 13 Nov 2026
- Who was impacted
- Check Point customers running Mobile Access on affected gateways. Check Point saw CVE-2026-123039 exploited against "a couple of dozen customers". The first wave targeted Israeli organizations, some of which suffered destructive activity; the second wave targeted organizations in several countries. Check Point says "neither wave showed a clear sector preference". No victim has been named.[1][2] Checked 13 Nov 2026
- Threat actor
- Not attributed. Not attributed. Check Point says "the evidence does not allow us to assess with high confidence the true nature of this operation" and lists several scenarios, including an access broker or a false flag. The TSGA and TSProxy tools belong to the PhiliKit family, which ESET links to the China-nexus group UNC5221; Check Point says the destructive activity and the Hebrew wiper note do not fully align with known Chinese-nexus groups.
- CVE
- CVE-2026-109618, CVE-2026-109619, CVE-2026-123039
Timeline
- The PHP2Shell flaws are patched, according to SecurityWeek. [3]
- First signs of exploitation on Check Point Mobile Access gateways, according to Check Point Research. This first wave targets Israeli organizations, with destructive activity against some of them. [1]
- A second wave targets organizations across several countries and sectors; Check Point saw no destructive activity in it. [1]
- Check Point publishes its advisory for CVE-2026-123039 (sk1000362), updated on November 12. Fixes ship in Jumbo Hotfix Accumulators for R82.20, R82.10, R82 and R81.20; R81.10 and R81, out of support, get no fix. An interim mitigation turns off the DynamicCLI process. [2]
- Check Point Research publishes its analysis of the campaign, with the wiper (destroy_v6, which leaves a politically themed note refusing any ransom talks) and indicators of compromise. [1][3]